What is the CVSS score of CVE-2026-26417?

CVE-2026-26417 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Cognix Platform are affected by CVE-2026-26417?

A critical access control flaw in Tata Consultancy Services Cognix Recon Client v3.0 enables authenticated users to reset passwords for any user account, creating immediate risk of unauthorized…

How to fix or mitigate CVE-2026-26417?

Within 24 hours: Identify all systems running Cognix Recon Client v3.0 and restrict network access to the password reset functionality via firewall rules or WAF policies; disable the password reset feature if operationally feasible. Within 7 days: Implement enhanced logging and monitoring of password reset activities; conduct audit of recent password resets for suspicious activity. Within 30 days: Contact TCS for patch availability and deployment timeline; evaluate alternative solutions or version upgrades; execute comprehensive user access review.

Cognix Platform CVE-2026-26417

HIGH

Improper Access Control (CWE-284)

2026-03-05 cve@mitre.org

Authentication Bypass Cognix Platform

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 19:16 nvd

HIGH 8.1

DescriptionCVE.org

A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to reset passwords of arbitrary user accounts via crafted requests.

AnalysisAI

Cognix Platform's password reset function fails to properly validate user permissions, enabling authenticated attackers to reset passwords for any user account through specially crafted requests. This broken access control vulnerability affects Cognix Recon Client v3.0 and carries high severity due to the potential for unauthorized account takeovers. No patch is currently available.

Technical ContextAI

Classified as CWE-284 (Improper Access Control). Affects the password reset component of Cognix Platform. A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to reset passwords of arbitrary user accounts via crafted requests.